Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to load test remote Yara config #25220

Open
sgress454 opened this issue Jan 7, 2025 · 0 comments
Open

Add ability to load test remote Yara config #25220

sgress454 opened this issue Jan 7, 2025 · 0 comments
Labels
#g-orchestration Orchestration product group :release Ready to write code. Scheduled in a release. See "Making changes" in handbook.

Comments

@sgress454
Copy link
Contributor

sgress454 commented Jan 7, 2025

From the parent ticket:

We need to add support to osquery-perf to simulate osquery requesting YARA rules using the new authenticated endpoint (to load test thousands of agents using this new endpoint).
osquery-perf: https://github.com/fleetdm/fleet/blob/main/cmd/osquery-perf/agent.go

The plan here is to update the runLiveQuery implementation so that it branches based on the contents of the live request. If it's determined to be a request for a Yara scan with a remote rule (i.e. it has "FROM yara" and "sigurl" in it) then we'll do the appropriate request to the Fleet instance to get the rule, and send a mock YARA response. Otherwise we'll send the regular mock response. Updating the runLiveQuery code means we can take advantage of the existing options around simulating failure and empty result sets.

@sgress454 sgress454 added #g-orchestration Orchestration product group :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. labels Jan 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
#g-orchestration Orchestration product group :release Ready to write code. Scheduled in a release. See "Making changes" in handbook.
Development

No branches or pull requests

1 participant